Enterprise AI has made remarkable progress in reasoning over data, generating insights, and even writing code. Yet a persistent gap remains: most AI clients still struggle to take reliable, governed action inside the business tools that organizations already use—Salesforce, Slack, Jira, GitHub, Google Workspace, and internal systems. Without a secure, standardized way to connect models to those tools, agents remain limited to conversation or require brittle, custom integrations that are difficult to govern at scale.
On October 19, 2026, Snowflake announced the preview of Tools for Cortex AI Gateway. This capability connects AI clients to the business tools an organization already uses through the Model Context Protocol (MCP). Supported clients include CoCo Desktop, CoCo CLI, Claude, and Cursor. Administrators control which MCP servers are available, which tools each server exposes, and can review tool-call activity—keeping AI tool use inside the same governance perimeter as the rest of the Snowflake environment.
This post examines the architecture of Cortex Tools, supported integrations, the security and control model, developer experience, early use cases, comparisons with other tool-calling approaches, implications for agent builders, and what the preview signals for production agentic systems in 2026.
The Tool-Use Gap in Enterprise AI
Modern large language models can decide when a tool is needed and formulate the correct call. The harder problems are operational and organizational:
- How does an AI client discover available tools without hard-coding integrations?
- How are credentials, permissions, and audit trails managed across many users and tools?
- How can administrators limit AI to read-only actions or specific operations?
- How do organizations avoid a proliferation of shadow AI connectors that bypass existing security controls?
Without answers to these questions, tool use either stays experimental or becomes a governance liability. Cortex Tools addresses the gap by standardizing on MCP—an open protocol for connecting AI clients to tools—and embedding the management of those connections inside Snowflake’s administrative and security model.
Architecture: MCP Inside the Governed Snowflake Environment
Cortex Tools is a capability of Cortex AI Gateway. It allows administrators to enable MCP servers (from a curated catalog or custom URLs) and make them available to approved AI clients. Once enabled and access is granted, clients such as CoCo Desktop and CoCo CLI can discover the servers automatically. Users still complete any required authorization with the third-party service themselves; Snowflake does not proxy or store those credentials on the user’s behalf in a way that bypasses the provider’s consent flow.
Key architectural elements include:
- Curated MCP server catalog — Pre-integrated servers for common enterprise services.
- Custom MCP servers — Ability to register internal or third-party servers by URL.
- Tool-level configuration — Administrators can expose only selected tools from a server (for example, read operations while disabling write or delete).
- Access distribution — Role-based grants (including the SNOWFLAKE$OPS.MCP$USER database role) control which users can reach which servers.
- Activity visibility — Administrators can review tool-call activity.
This design keeps the control plane for tool access inside Snowflake while allowing the actual tool invocations to occur through standard MCP interactions with the target services.
Supported Integrations and Extensibility
In the preview, administrators can enable servers from a curated catalog that includes services such as:
- Atlassian (Jira, Confluence, etc.)
- GitHub
- Google Workspace
- Salesforce
- Slack
- Snowflake itself (for certain capabilities)
Custom MCP servers can be added by providing a URL, enabling organizations to connect internal tools, proprietary systems, or additional third-party services that speak MCP. This combination of catalog convenience and custom extensibility supports both rapid adoption of common tools and long-term flexibility.
Security Model and Administrative Controls
Security and governance are central to the design:
Key Capabilities
- Administrator-only server management — Only users with the ACCOUNTADMIN role can administer MCP servers in Tools during the preview.
- Fine-grained tool exposure — Individual tools within a server can be enabled or disabled, allowing read-only policies or other least-privilege configurations.
- Role-based access distribution — Servers are made available to end users through explicit grants.
- User-managed third-party authorization — Each user completes their own consent/authorization flow with the external service.
- Activity review — Administrators can inspect tool-call activity for oversight and compliance.
- Client discovery controls — CoCo Desktop and CLI automatically surface only the servers the user’s roles are permitted to access.
These controls allow organizations to expand AI tool use without creating uncontrolled integration sprawl.
Developer and End-User Experience
For end users of CoCo Desktop or CoCo CLI, the experience is designed to be low-friction. Once an administrator has enabled a server and granted the necessary access, the client discovers it automatically. The user authorizes their own connection to the third-party service when required, after which the AI client can invoke the exposed tools as part of normal conversation or agent workflows.
For other MCP-compatible clients (Claude, Cursor, etc.), users or administrators add the server using its connection URL obtained from the Tools interface in Snowsight. The underlying protocol remains standard MCP, so existing client tooling and patterns continue to apply.
Developers building agents benefit from a consistent discovery and invocation model. Instead of maintaining separate connectors for every tool and every client, they can rely on MCP as the common interface and on Snowflake’s administrative layer for access control and visibility.
Early Use Cases
Early applications of Cortex Tools center on giving AI clients the ability to act inside existing business systems under governance:
- Retrieving or updating records in Salesforce during a customer conversation
- Creating or querying issues in Jira as part of an incident or project workflow
- Searching and summarizing content in Slack or Google Workspace
- Interacting with GitHub repositories for code-related tasks
- Combining Snowflake data insights with actions in external systems within a single agent session
In each case, the value lies in keeping the AI interaction inside a controlled environment while still reaching the systems where work actually happens.
Comparisons to Other Tool-Calling Frameworks
Several approaches to tool use exist in the broader ecosystem:
- Custom function calling / plugins — Tightly coupled to a specific model or platform; often require per-tool development and separate credential management.
- Open-source agent frameworks with tool registries — Flexible but typically leave security, multi-tenancy, and enterprise auditability as exercises for the implementer.
- Vendor-specific connector marketplaces — Convenient for supported tools but can create lock-in and inconsistent governance across vendors.
Cortex Tools differentiates itself by standardizing on the open MCP protocol while embedding the management, access control, and visibility of those connections inside an enterprise data cloud that organizations already use for governance. The result is a model that aims to be both interoperable and administrable at scale.
Implications for Agent Builders and What This Signals for 2026
For teams building production agents, Cortex Tools lowers the barrier to giving agents real-world capabilities without forcing them to become integration platforms. Agent builders can focus on reasoning, orchestration, and user experience while relying on a governed MCP layer for tool access.
More broadly, the preview signals that production agentic systems in 2026 are expected to:
- Operate under explicit administrative control rather than unconstrained tool access
- Support least-privilege configurations at the tool level
- Provide visibility into what AI clients are doing with external systems
- Leverage open standards (MCP) to avoid proprietary lock-in
- Integrate cleanly with the identity, role, and audit mechanisms enterprises already operate
Organizations that treat tool access as a first-class governed resource—rather than an afterthought—will be better positioned to scale agentic workflows safely.
Actionable Insights for Developers and Architects
- Inventory the business tools that would deliver the highest value if reachable by AI clients under governance (CRM, ticketing, collaboration, code, etc.).
- Begin with catalog servers that match existing high-usage systems and apply least-privilege tool exposure (prefer read-only where possible).
- Establish a clear ownership model: which team administers MCP servers, how access is requested and reviewed, and how activity is monitored.
- Pilot with CoCo Desktop/CLI users who already work inside Snowflake’s AI surfaces, then expand to other MCP clients as needed.
- For internal tools, evaluate exposing them via custom MCP servers rather than building one-off connectors for every AI client.
- Document the authorization experience for end users so that consent flows with third-party services are smooth and well-understood.
- Treat tool-call activity logs as a compliance and optimization resource—review early to refine policies and identify high-value patterns.
- Align agent design with the available tool surface: agents should degrade gracefully when a tool is unavailable or restricted.
- Coordinate with security and identity teams early so that MCP access patterns fit existing SSO, conditional access, and audit requirements.
- Monitor the preview closely for expansions in the catalog, regional availability, and additional administrative controls as the feature matures toward general availability.
Cortex Tools Preview represents a practical step toward closing the tool-use gap in enterprise AI. By connecting AI clients to business systems through the open Model Context Protocol, while keeping enablement, access control, tool selection, and activity review inside Snowflake’s governed environment, the capability offers a path to more useful—and more controllable—agentic systems. For organizations building production AI in 2026, the combination of open standards and enterprise-grade administration is likely to prove decisive.